When IT will not let a sync service near your calendar
5-minute read
Every hosted calendar-sync service begins the same way: sign in, and give us access to your work calendar. For a lot of people that is where it ends — not because they don’t want the feature, but because they are not allowed to hand that over.
Sometimes it is written policy: no third-party OAuth grants, no app-specific passwords, no data processor we haven’t reviewed. Sometimes the tenant simply blocks the consent screen and you never get an explanation. And sometimes it is not policy at all, just a reasonable person deciding they would rather not put a permanent credential to their employer’s calendar into a company they had never heard of last Tuesday.
The move that gets around it
The calendars are already on your device. Your Mac has already been told about the work account — by your employer’s own configuration, through the accounts pane, with whatever credential IT already sanctioned. Calendar Mirror reads and writes through Apple’s own calendar framework, using that existing access. There is no login, no token, no server, and nothing transmitted: the copy is made on the device, between two calendars that were both already sitting there.
This is a meaningful difference rather than a marketing one, and it is checkable. The source is public and MIT-licensed, so anyone — including a security reviewer who wants to be difficult about it — can read exactly what it does. The App Store build is sandboxed and declares no network access for syncing. If a reviewer asks “where does the calendar data go?”, the answer is a short one.
What that means in practice
- No account to create, so no account to be breached, and nothing to cancel later.
- No app-specific password for iCloud, which several hosted tools require and which grants far more than calendar access.
- No third-party appearing in your tenant’s list of connected applications.
- It keeps working when you are offline; there is no service to be down.
- One purchase, no renewals, no per-seat licence to explain to anyone.
The caveat worth reading twice
“No credential to hand over” is not the same as “permitted”. Copying a work calendar into a personal account moves company information onto personal devices and, if you then share that copy, into other people’s view. Plenty of employers are fine with an employee knowing their own schedule on their own phone. Some are not, and a few have explicit rules about it.
If you are in any doubt, the busy-only projection is the version most policies can live with: the copy carries the times and nothing else — no titles, no locations, no notes, no attendees. And whatever you choose, the decision is being made on your device rather than by a service you have to trust.